.builds/alpine.yml: upgrade to Alpine 3.20
server: add AnonRouter function
To expose anonymous (unauthenticated) routing to downstream core-go
users.
auth/middleware: convert user types to uppercase
server: fix playground on config.Debug
A recent change made it so that the playground required authentication
to access in debug mode; this moves it under the other auth-free
endpoints.
auth: add Grants.IsSubset
This is a little bit hacky. Previously DecodeGrants would only store the
list of grants associated with the current service. This minimizes API
breakage by storing all grants as $service/$grant in the map key and
stores the local service name in the grant object, and updates
Grants.Has() to accept "$grant" and infer that it refers to a local
service or accept the fully qualified "$service/$grant" to test against
grants for any service -- which IsSubset makes use of to test that one
Grant object is a subset of another with respect to all services it has
grants for.
server: use routing groups
Instead of hardcoding some exceptions in the auth middleware, use a
different routing group for routes that do not require auth. Makes the
auth middleware more generic and also removes a lot of unneccessary
middleware processing from routes that don't need it.
For now, the added group is not accessible from outside the module, but
if the need arises, this might be an option.
config: print loaded config(s) to log
email: update StartTLS usage per go-smtp changes
config: allow spreading config over multiple files
This is the Go-equivalent to
https://lists.sr.ht/~sircmpwn/sr.ht-dev/patches/47657
This commit enables spreading the config in /etc/sr.ht - and, crucially,
_only_ in /etc/sr.ht - over multiple .ini files.
If a file config.ini is found (either in current or parent directory, or
/etc/sr.ht) it (and only it) is loaded and any other ini files are
ignored. To utilize multiple configs, they must be in /etc/sr.ht, and
none of them must be called config.ini.
Spreading the config over multiple files will make it much easier to
create containerized versions, where e.g. different secrets can be made
available in different files, but rendering it all into one big file
would require some preprocessing.
auth: add auth.IPAddress
With support for X-Forwarded-For
auth/middleware: set WWW-Authenticate header field
See RFC 6750 section 3.
client: rename Execute to Do
583d0b1bcb08 ("client/graphql: handle GraphQL errors") changed
Execute behavior by wrapping the result into a struct with "data"
and "errors" fields. This is a breaking change, but it's hard to
spot when upgrading core-go because it won't cause a compilation
error.
Rename Execute to Do to break the build and force callers to update
accordingly.
auth: add RequireMiddleware
Same as Middleware, but requires auth for all requests. Will be
useful to drop hacks from pages.sr.ht.
s3: add [objects]s3-insecure
Disables TLS. Useful for local development.
s3: add NewClient and URL
Centralizes the logic to create an S3 client and get the base URL.
email: make PGP private key optional
Services other than meta.sr.ht don't really have a use for the
private PGP key.
Add a CanPGPSign method so that meta.sr.ht can emit a warning or
error when the PGP key is missing.
client/graphql: handle GraphQL errors
Instead of leaving it up to the caller to check for GraphQL errors,
centralize in core-go.
email: improve mail.ParseAddress error message
server/directives: disambiguate AnonInternal error message
AUTH_INTERNAL won't work with AnonInternal.